MEDIUM5.3Go
GHSA-964w-f6gj-5236· CVE-2026-66064, GO-2026-6134goshs has ACL Bypass & Path Traversal
Modified: 8/18/2026
package
Go/goshs.de/goshs
pkg:go/goshs.de/goshs
CRITICAL9.1Go
GHSA-hq33-8jgp-8qq3· CVE-2026-64863, GO-2026-6136goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite
Modified: 8/18/2026
HIGH7.5Go
GHSA-rmxw-pq4x-3fvh· CVE-2026-54719, GO-2026-6133goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)
Modified: 8/18/2026
MEDIUM6.5Go
GHSA-wg2q-39h6-66x9· CVE-2026-66063, GO-2026-6137goshs has a Path Traversal issue
Modified: 8/18/2026
—Go
GO-2026-5519· GHSA-mxg3-432p-mr72goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request in goshs.de/goshs
Modified: 6/25/2026
—Go
GO-2026-5625· CVE-2026-42091, GHSA-rhf7-wvw3-vjvmgoshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs
Modified: 6/25/2026
—Go
GO-2026-5878· CVE-2026-50138, GHSA-3whc-qvhv-xqjpgoshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags in goshs.de/goshs
Modified: 7/7/2026
—Go
GO-2026-5881· CVE-2026-50139, GHSA-j48m-h7xq-2xpjgoshs: Share-link ?token=… redemption races past download limit in goshs.de/goshs
Modified: 7/7/2026
—Go
GO-2026-6132· CVE-2026-62325, GHSA-rjrw-mjq6-hpmmgoshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884) in goshs.de/goshs
Modified: 8/18/2026
—Go
GO-2026-6133· CVE-2026-54719, GHSA-rmxw-pq4x-3fvhgoshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs
Modified: 8/18/2026
—Go
GO-2026-6134· CVE-2026-66064, GHSA-964w-f6gj-5236goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs
Modified: 8/18/2026
—Go
GO-2026-6136· CVE-2026-64863, GHSA-hq33-8jgp-8qq3goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs
Modified: 8/18/2026
—Go
GO-2026-6137· CVE-2026-66063, GHSA-wg2q-39h6-66x9goshs has a Path Traversal issue in github.com/patrickhener/goshs
Modified: 8/18/2026